Privacy Notice – GEOSYS Bilişim Sistemleri A.Ş.

DRAFT — pending legal review. This text is a draft prepared for GEOSYS's new website. It must not be treated as final until our legal counsel has reviewed and approved it; its content may change as a result of that review. The Turkish version prevails in case of any discrepancy.

Last updated: 23 October 2026 · Version: 2026-10

Privacy Notice under the Turkish Personal Data Protection Law No. 6698

1. Data controller

The data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK” or the “Law”) is:

Company: GEOSYS BİLİŞİM SİSTEMLERİ ANONİM ŞİRKETİ (“Company”, “GEOSYS”)
MERSIS No: 0394127612000001
Address: Ortadoğu Teknik Üniversitesi Teknokent Yerleşkesi Üniversiteler Mahallesi İhsan Doğramacı Bulvarı No:33 K1-5 Çankaya/ANKARA, Türkiye
Registered e-mail (KEP): geosys@hs01.kep.tr
E-mail: info@geosys.com.tr
Web: https://www.geosys.com.tr

2. Scope of this notice

As data controller, GEOSYS provides the following information under Article 10 KVKK and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform regarding personal data obtained from visitors to our website, users of the contact form, blog/newsletter members, job and internship applicants, and data subjects submitting requests under KVKK.

Our employees are informed through a separate notice: Privacy Notice for Employees (Turkish). Details on cookies are provided in our Cookie Policy.

3. Categories of personal data processed

Our website processes only the data listed for the channels below:

Identity: first and last name; for KVKK requests, Turkish ID number or passport number.
Contact: e-mail address; for KVKK requests, also the postal address and telephone number you provide.
Request / complaint management: subject and message of the contact form; content of a KVKK request, your relationship to the Company, your preferred response channel and any attachments.
Professional experience and education: the description in a job/internship application and the education, certificates, languages, skills and work experience in your CV.
Marketing: your e-mail address and subscription/confirmation status for the newsletter.
Transaction security: IP address (only as a salted hash in the cookie consent log), browser information, date and time of access, requested page address (without query strings) and security check information.

Our website currently does not use Google Analytics, advertising pixels or similar analytics or advertising tracking tools.

4. Purposes, legal bases and retention periods by channel

Channel	Data processed	Purpose	Legal basis (KVKK)	Retention
Contact form	Name, e-mail, subject (optional), message (max. 180 characters)	Answering your requests	Art. 5/2-c, Art. 5/2-f	24 months
Job / internship application form	First and last name, e-mail, description (optional), CV (optional)	Running the recruitment process and assessing suitable positions	Art. 5/2-c, Art. 5/2-f	6 months
Newsletter	E-mail address, subscription and confirmation status	Sending e-mails about blog posts, news and events	Art. 5/1 (explicit consent)	While you are subscribed; unconfirmed sign-ups 7 days
KVKK request form	Identity (Turkish ID or passport no.), contact, relationship to the Company, request text, preferred response channel, attachments (optional)	Receiving, verifying and concluding requests under Art. 11 KVKK	Art. 5/2-ç, Art. 5/2-e	10 years after the request is closed
Cookie consent log	Consent ID, choices, policy version, timestamp, salted hash of the IP address, truncated user-agent	Proof of consent	Art. 5/2-ç, Art. 5/2-f	3 years
Security and server logs	IP address, request time, requested address (without query strings), browser information	Keeping the site and systems secure, detecting and preventing abuse	Art. 5/2-f	In size-capped, rotating system logs; the oldest entries are deleted automatically when the cap is reached

At the end of the retention periods your personal data is erased, destroyed or anonymised in accordance with Article 7 KVKK and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. Data that must be kept longer because of a dispute or a legal obligation is kept only for that purpose and only as long as necessary.

4.1. Contact form

Your name, e-mail address, optional subject and message of up to 180 characters are processed only to answer your request and to contact you for that purpose. The legal bases are that processing is directly related to the establishment or performance of a contract concerning your request (Art. 5/2-c) and our legitimate interest in answering incoming requests (Art. 5/2-f). The data is kept for 24 months.

4.2. Job and internship application form

Your first and last name, e-mail address, optional description and optional CV file (PDF, AVIF or HEIF) are processed to run the recruitment process and assess suitable positions. The legal bases are that processing is directly related to the establishment of an employment contract (Art. 5/2-c) and our legitimate interest in assessing suitable candidates (Art. 5/2-f).

Applications and CV files are stored encrypted and can be viewed only by authorised Human Resources staff.
Applications are permanently deleted after 6 months.
Please do not include special categories of personal data (e.g. health, religion, sect, race, ethnic origin, political opinion, membership of an association, foundation or trade union, criminal convictions, biometric data) or a photo in your application or CV. Such data is not needed to assess your application.
If you include special categories of data anyway, they are not used in the assessment, are not otherwise processed or transferred, and are deleted together with your application, at the latest when the application's retention period ends.

4.3. Newsletter

The e-mail address you provide to receive e-mails about our blog posts, news and events is processed solely on the basis of your explicit consent under Article 5/1 KVKK.

Double opt-in: after you sign up, we send a confirmation link to your e-mail address; your subscription starts only when you click it. Sign-ups not confirmed within 7 days are deleted.
Withdrawing consent: you can withdraw your consent at any time, free of charge and without giving reasons, using the unsubscribe link in every e-mail we send. Withdrawal does not affect the lawfulness of earlier processing.
Suppression record: when you unsubscribe, your e-mail address is kept on a suppression list so that your opt-out is honoured and no further messages are sent to you. This record is processed only for that purpose, based on Art. 5/2-ç and Art. 5/2-f KVKK.
Message Management System (İYS): consent and opt-out records for messages that qualify as commercial electronic messages are registered in the İleti Yönetim Sistemi (İYS) under Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages. You can also opt out via İYS.

4.4. KVKK request form

The identity data (Turkish ID number or passport number), contact details, relationship to the Company, request text, preferred response channel and optional attachments you submit through the online form at /en/data-request are processed to receive your request, verify your identity, conclude the request and notify you of the result.

Legal bases: compliance with the data controller's legal obligation (Art. 5/2-ç; Art. 13 KVKK) and the establishment, exercise or protection of a right (Art. 5/2-e).
Turkish ID and passport numbers are stored encrypted.
Request records are kept for 10 years after the request is closed.

4.5. Cookie consent log

When you save your cookie choices, a random consent ID, your choices, the policy version, a timestamp, a salted hash of your IP address and a truncated user-agent are kept for 3 years as proof of consent. See our Cookie Policy for details.

4.6. Security and server logs

Technical records of requests to our site (IP address, time, requested page address and browser information) are processed based on our legitimate interest (Art. 5/2-f) to keep the site and systems secure, fix errors and detect and prevent abuse. Query strings in page addresses are not logged. These records are kept in size-capped, rotating system logs; when the cap is reached, the oldest entries are deleted automatically.

Our forms are protected against spam and automated abuse by Cloudflare Turnstile; in this context your IP address and browser information may be processed by Cloudflare (Art. 5/2-f).

5. Method of collection

Your personal data is collected electronically, by automated or partly automated means, when you fill in forms on our website, sign up for the newsletter, save your cookie choices and visit our site; and through the respective channel when you submit a KVKK request in writing, via KEP or by e-mail.

6. Transfers of personal data

Limited to the purposes above and in accordance with Articles 8 and 9 KVKK, your personal data may be transferred to the following recipients:

Recipient	Role	Service	Location
Google Cloud (Google LLC / Google Cloud EMEA)	Processor	Virtual machine hosting: all form data, consent records and server logs	USA (us-east1 region)
Cloudflare, Inc.	Processor	CDN, DNS, security and Turnstile spam protection; IP address and request information	Servers worldwide
Our e-mail service provider	Processor	Sending notification e-mails triggered by the site (e.g. newsletter confirmation link, form notifications)	Provider's servers
Google LLC (Google Maps)	Third party	Embedded map; loaded only if you consent to marketing & third-party content cookies	USA
Competent public authorities and courts	Recipient	Compliance with legal obligations and requests of competent authorities	Türkiye
Lawyers, auditors and consultants	Recipient	Conducting legal proceedings and protecting rights	Türkiye

Your personal data is not sold and is not shared with third parties for advertising.

7. Cross-border transfer

Because the servers hosting our site are located in the USA and Cloudflare services are delivered over a global infrastructure, personal data processed through our website is transferred abroad.

Under Article 9 KVKK as amended by Law No. 7499, in force since 1 June 2024, data may be transferred abroad primarily on the basis of an adequacy decision. There is no adequacy decision announced by the Personal Data Protection Board for the USA.
The Company therefore relies, among the appropriate safeguards under Article 9(4) KVKK, on standard contracts announced by the Board. Standard contracts are notified to the Personal Data Protection Authority within 5 (five) business days of signature.
Where a standard contract cannot be applied, transfers are based on another appropriate safeguard provided for in Article 9 or on the incidental-transfer cases in Article 9(6).
Google Maps content is loaded only with your explicit consent; in that case your IP address and cookie data are sent directly to Google LLC.

8. Data security

In line with Article 12 KVKK, appropriate technical and organisational measures are taken to protect your personal data. These include encrypted connections (HTTPS/TLS), encrypted storage of CV files and of Turkish ID and passport numbers, access to applications limited to authorised staff, storing IP addresses in the consent log only as a salted hash, not logging query strings in server logs, and form design that follows the data minimisation principle.

9. Your rights under KVKK

Under Article 11 KVKK, by applying to the Company you have the right:

to learn whether your personal data is processed,
to request information about the processing if it is,
to learn the purpose of the processing and whether the data is used in line with that purpose,
to know the third parties in Türkiye or abroad to whom your personal data is transferred,
to request rectification if your personal data is incomplete or inaccurate,
to request erasure or destruction of your personal data under the conditions of Article 7 KVKK,
to request that rectification, erasure or destruction be notified to the third parties to whom your data was transferred,
to object to a result to your detriment arising from analysis of your data exclusively by automated systems,
to claim compensation if you suffer damage because of unlawful processing of your personal data.

10. How to exercise your rights

You can submit requests concerning your rights under Article 11 KVKK, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by any of the following methods:

Online request form: the KVKK request form at /en/data-request,
Written application: a wet-signed letter delivered by hand to the address above or sent by post or notary,
KEP: from your registered electronic mail (KEP) address to geosys@hs01.kep.tr,
E-mail: to info@geosys.com.tr from an e-mail address you have previously provided to us and that is registered in our systems.

Under the Communiqué, your application must state your first and last name, your signature if the application is in writing, your Turkish ID number (for Turkish citizens) or your nationality and passport number (or ID number, if any) for foreign nationals, your residential or business address for notifications, your e-mail address, telephone and fax number if any, and the subject of your request.

Your request will be concluded free of charge as soon as possible according to its nature and within 30 (thirty) days at the latest, as required by Article 13 KVKK. If the action requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your request is rejected, the reasons will be given in writing or electronically.

If your request is rejected, if you find our answer insufficient or if we do not answer in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 KVKK within 30 (thirty) days of learning of our answer and in any case within 60 (sixty) days of your application.

11. Changes

This notice may be updated in line with changes to our processing activities or the legislation. Updates take effect when published on www.geosys.com.tr. The current version is always available on this page.